ViewState-based Session Management CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An ASP.NET application uses ViewState to store a user's role for UI rendering decisions. The role is also stored in a server-side session. A security review recommends not relying on client-side data for authorization. What should the developer do?

   • ARemove the role from ViewState and always read it from Session on the server.
   • BStore the role in a hidden field and read it on the server.
   • CUse ViewState MAC validation to ensure the role is not tampered with.
   • DEncrypt the ViewState to protect the role.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An ASP.NET application is being migrated from a single server to a web farm. The application uses ViewState to store a user's role and a non-sensitive UI flag. The security team mandates that ViewState must be protected against tampering and disclosure. The developer must also ensure that the migration does not break existing sessions. What is the most critical configuration to address?

   • AConfigure a shared machineKey with explicit validation and decryption keys on all servers.
   • BStore the role in Session and keep the UI flag in ViewState with MAC validation.
   • CDisable ViewState and use cookies for all state.
   • DEnable ViewState encryption and MAC validation on each server independently.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An ASP.NET application uses ViewState to store a user's shopping cart ID. The cart ID is not sensitive, but the application is experiencing performance issues because the ViewState is large. The developer discovers that the ViewState contains the entire cart contents, not just the ID. The developer wants to reduce the ViewState size while keeping the cart ID available. What is the best approach?

   • AStore only the cart ID in ViewState and retrieve the cart contents from the database or Session on each postback.
   • BCompress the ViewState using a custom module.
   • CStore the cart contents in a cookie.
   • DEncrypt the ViewState to reduce its size.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   A developer is building a multi-step wizard in ASP.NET Web Forms. The wizard needs to preserve user input across multiple postbacks, but the data is not sensitive and the total size is small. Which approach is most appropriate?

   • ADisable ViewState and rely on query strings.
   • BUse Session to store the wizard data.
   • CUse ViewState to store the wizard data across postbacks.
   • DUse a cookie to store the wizard data.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An ASP.NET application has ViewState encryption enabled, but a security audit finds that the ViewState is still vulnerable to tampering. The developer discovers that the machineKey is set to AutoGenerate. What is the likely cause and the fix?

   • AThe ViewState is too large; enable compression.
   • BAutoGenerate keys are not shared across servers, causing MAC validation to fail; set a fixed machineKey.
   • CAutoGenerate keys are weak; use a stronger encryption algorithm.
   • DEncryption does not include a MAC; enable MAC validation separately.
   Reveal Solution Discussion Select an answer first